CVE-2021-21729

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Some ZTE products have CSRF vulnerability. Because some pages lack CSRF random value verification, attackers could perform illegal authorization operations by constructing messages.This affects: ZXHN H168N V3.5.0_EG1T5_TE, V2.5.5, ZXHN H108N V2.5.5_BTMT1

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-330CWE-352

Affected software

VendorProductVersions
n/aZXHN H168N,ZXHN H108NV3.5.0_EG1T5_TE; V2.5.5_BTMT1

References

Timeline

Published
Apr 13, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-21734.1Vulnerability in the Recovery component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1, 18c and 19c.CVE-2021-217309.8A ZTE product is impacted by improper access control vulnerability. The attacker could exploit this vulnerability to access CLI by brute forCVE-2021-217318.1A CSRF vulnerability exists in the management page of a ZTE product.The vulnerability is caused because the management page does not fully vCVE-2021-217327.5A mobile phone of ZTE is impacted by improper access control vulnerability. Due to improper permission settings, third-party applications caCVE-2021-217334.9The management system of ZXCDN is impacted by the information leak vulnerability. Attackers can make further analysis according to the inforCVE-2021-217346.5Some PON MDU devices of ZTE stored sensitive information in plaintext, and users with login authority can obtain it by inputing command. ThiCVE-2021-217356.5A ZTE product has an information leak vulnerability. Due to improper permission settings, an attacker with ordinary user permissions could eCVE-2021-217367.2A smart camera product of ZTE is impacted by a permission and access control vulnerability. Due to the defect of user permission management CVE-2021-217377.5A smart STB product of ZTE is impacted by a permission and access control vulnerability. Due to insufficient protection of system applicatioCVE-2021-217386.1ZTE's big video business platform has two reflective cross-site scripting (XSS) vulnerabilities. Due to insufficient input verification, theCVE-2021-217394.6A ZTE's product of the transport network access layer has a security vulnerability. Because the system does not sufficiently verify the dataCVE-2021-21744.4Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.33 and prior and
CVE-2021-21729: Medium severity, CVSS 6.5 | Vulnix